CodeWhale BotandClaude Opus 5.5
59e941a511
Hunter moved the Codewhale repositories to github.com/codewhale-hq on 2026-10-05. Rewrite Hmbown/<moved repo> slugs to codewhale-hq/<repo> in docs, READMEs (all 19), website, CHANGELOGs, workflows, issue templates, Cargo/npm/VS Code/nix/winget metadata, install and updater code, the bundled first-party marketplace catalog and their tests: 1,795 references in 434 files, plus four escaped regex literals. Docker images publish to ghcr.io/codewhale-hq/codewhale from the next release. Old URLs keep working through GitHub's transfer redirects (verified live: API releases/latest, HTML releases/latest, release asset downloads, codeload tarballs, git clone), so released clients keep updating. Left unchanged on purpose: Hmbown/codewhale-cu-plugin (not moved yet; its shipped updater refuses redirects), Hmbown/deepseek-skills, cwc and other repos that did not move; package identities (winget Hmbown.CodeWhale, NSIS publisher); vendor/codewhale-ratatui (frozen reviewed package); and the extension-host GitHub adapter with tools/github/report.rs and their parity fixture, which need a bundle rebuild and move together in a follow-up. README translation stamps updated to the new README.md hash. Validation: npm test (wrapper 101/0, SDK 19/0, extension host 398 passed / 0 failed / 7 skipped, web 763/0) and npm run check:web exit 0 (one pre-existing facts-lib.mjs lint warning). cargo check --workspace --tests --all-features --locked: exit 0. cargo test -p codewhale-cli -p codewhale-release -p codewhale-protocol and the touched codewhale-tui modules (client, cloud_dispatch, commands, dispatch_runner, llm_client::mock, oauth, operate, plugins::marketplace, remote_control, remote_setup, tools::mcp_registry, tools::web::fetch, working_set, tui::ui::tests): all ok, 0 failed. check-readme-translations (18 in sync), readme locales, TUI locale parity, product vocabulary, web locales, contributor credit, plugin claims, release-workflows.test.js and check-versions all pass. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: CodeWhale Bot <[email protected]>
4.2 KiB
Security Policy
codewhale is a coding agent with direct access to file operations, shell execution, and the network. Security disclosures are taken seriously.
Supported Versions
Only the latest stable release receives security patches. No backports to older versions.
| Version | Supported |
|---|---|
| latest stable | ✅ |
| < latest | ❌ |
Check the releases page for the current version.
Reporting a Vulnerability
Do not open a public GitHub issue for security vulnerabilities.
Report privately via one of:
- GitHub private advisory: github.com/codewhale-hq/CodeWhale/security/advisories/new
- Email: [email protected] — include
[SECURITY]in the subject line
Include in your report:
- A description of the vulnerability and the impact if exploited
- Steps to reproduce or a proof of concept
- Affected versions and configuration details
- Any suggested mitigation (optional)
Response Timeline
| Phase | Target |
|---|---|
| Acknowledgment | Within 48 hours of receipt |
| Assessment | Within 5 days — triage severity, scope, and fix approach |
| Patch (critical) | Within 14 days from assessment |
| Patch (moderate/low) | Next feature release or per-maintainer timeline |
| Disclosure | After patch is shipped and users have had time to update |
You will receive status updates at each phase. If the timeline slips, we will communicate the reason and the revised estimate.
Scope
In scope (what counts)
- Remote code execution through crafted prompts or model responses
- Sandbox escape — breaking out of an active Seatbelt/bubblewrap wrapper or a declared workspace boundary
- Credential leak — exfiltration of API keys, tokens, or environment secrets
- Arbitrary file read/write outside the intended workspace (
PathEscapebypass) - SSRF via
fetch_urlorweb_searchagainst internal network endpoints - Unauthorised MCP server access or tool invocation
Out of scope
- Social engineering of the maintainer or contributors
- Denial of service / rate-limit exhaustion against the DeepSeek API
- Vulnerabilities in third-party dependencies (report to the upstream project)
- Attacks requiring physical access to the victim's machine
- Theoretical ML-model injection attacks not demonstrated in the codewhale context
If you are unsure whether a bug is in scope, report it anyway. We will triage and respond.
WeCom Bridge Security
The WeCom Bridge (integrations/wecom-bridge/) extends Codewhale to WeCom
(企业微信) Smart Bot WebSocket sessions. It inherits all standard Codewhale
security boundaries and adds bridge-specific controls.
Bridge-specific protections
- No public port: The bridge communicates with
codewhale serve --httpon127.0.0.1only - Token gate: All runtime API calls carry
CODEWHALE_RUNTIME_TOKEN - Chat allowlist: Only chats/users listed in
WECOM_CHAT_ALLOWLISTcan interact. First-pairing mode (WECOM_ALLOW_UNLISTED=true) is meant for onboarding only - Approval required: Tool calls from WeCom sessions must be approved — either via explicit
/allow <id>commands or natural-language keywords (允许,yes,ok, etc.) - No workspace exposure: Only prompts, status summaries, and approval requests are sent to WeCom. Workspace contents, shell output, and runtime internals stay on the local machine
Reporting WeCom Bridge vulnerabilities
Report bridge-specific security issues through the same channels listed above.
Include the bridge version (check package.json) and your WeCom deployment configuration
(sensitive values redacted). Bridge logs may be requested for reproduction.
Bridge environment safety
WECOM_BOT_SECRETandCODEWHALE_RUNTIME_TOKENmust never be committed to git- The
.envfile is gitignored; use.env.exampleas the template - Rotate secrets periodically, especially after sharing screen captures
- Use
CODEWHALE_APPROVAL_TIMEOUT_MS(default 5 min) to limit the approval window
Hall of Fame
We maintain a hall of fame for reporters who submit verified security vulnerabilities. To be credited, include your preferred name / handle in the report.
No entries yet — be the first.